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Quantum information is a valuable resource which can be encrypted in order to protect it. We 
consider the size of the one-time pad that is needed to protect quantum information in a number of 
cases. The situation is dramatically different from the classical case: we prove that one can recycle 
the one-time pad without compromising security. The protocol for recycling relies on detecting 
whether eavesdropping has occurred, and further relies on the fact that information contained in 
, the encrypted quantum state cannot be fully accessed. We prove the security of recycling rates when 

authentication of quantum states is accepted, and when it is rejected. We note that recycling schemes 
respect a general law of cryptography which we introduce relating the size of private keys, sent qubits, 
and encrypted messages. We discuss applications for encryption of quantum information in light 
of the resources needed for teleportation. Potential uses include the protection of resources such 
as entanglement and the memory of quantum computers. We also introduce another application: 
encrypted secret sharing and find that one can even reuse the private key that is used to encrypt 
a classical message. In a number of cases, one finds that the amount of private key needed for 
' authentication or protection is smaller than in the general case. 
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When encrypting classical information, the only method that gives unconditional security is the Vernam cipher or 
' one-time pad. Such a private key is a random string of correlated bits shared between two parties, who we shall call 
Alice and Bob. By XORing [IJ a message with the private key, Alice can send a message to Bob which cannot be 
read by an eavesdropper (Eve). However, this is a rather expensive protocol because classically, Alice and Bob cannot 
securely increase the size of their private key without meeting. When they have finished using their private key, they 
may therefore be tempted to reuse it. Of course, reusing the private key is highly insecure, and Eve will be able to 
exploit redundancies in messages to learn the random string of the key and gain information about the messages. It 
may be that no one is actually eavesdropping on Alice and Bob, but because they have no way of being certain, they 
^5 ' should never reuse the key. 

Just as classical information is valuable and may need to be encrypted, quantum information is also of value, and 
i" 1 ' recently, it has been proposed that one may also want to encrypt it . Protocols have also been introduced to 
authenticate quantum information [c.f. 0], and the case of encrypting classical data that has been encoded in 
quantum states has also been considered 0. 

In @ and (c.f. also 0), it was shown that if the source to be encrypted is a quantum message of m qubits, 
CJ^ 1 then the size of the private key for perfect encryption needs to be twice as large as in the classical case. I.e. a 
correlated random string of 2m bits is necessary and sufficient to encrypt the quantum message. Such a protocol is 
called a Private Quantum Channel (PQC) and care should be taken to distinguish between the PQC where quantum 
information is encrypted (using classical bits), and quantum key distribution 0, where one uses the properties of 
quantum states to encrypt classical data. 

An immediate question which arises in the context of the PQC, is what exactly does it mean to encrypt quantum 
information? In classical encryption, one usually has the situation that Alice knows some message which she wants 
to send to Bob, and Eve does not know the message and wants to learn it. In the encryption of quantum information, 
the opposite can be the case: Alice may not know the state being sent, and Eve may know it, and want it in order 
to use it. Additionally, if the state is unknown to Eve, then the quantum information is in some sense, already 
encrypted. Eve can get no more than one classical bit of information from a single unknown qubit. She cannot access 
the quantum information. The more likely use of the PQC is therefore when Eve knows something about the state, 
and Alice and Bob want to make sure that Eve can not use it. For example, the state may be some valuable resource 
such as the memory of a quantum computer or entanglement, and Alice and Bob want to protect this resource from 
being used by an adversary. 

Perhaps an easier to define scenario exists in the authentication of quantum information. Here, Alice wants to 
send Bob a state in such a way that Bob can tell if the state has been tampered with. The protocols for a quantum 
authentication scheme (QAS) are closely related to the PQC, and therefore, much of our discussion will be related to 
them. In fact, any QAS is necessarily a PQC 4|. 

Notwithstanding the necessity proofs of 0y|], in light of the fact that Eve can only extract one classical bit of 
information from a qubit, one might wonder in what sense the two classical bits are needed. In fact, we will show that 
one need not use up this classical key - it can be recycled. When encrypting or authenticating quantum information, 



2 



one can break the cardinal rule of cryptography and reuse the one-time pad. 

A strong indication that key-recycling of a classical key is possible, was given in There, shared singlets, rather 
than a classical key, were used to encrypt quantum information. It was then shown that by performing distillation on 
the singlets, one could reuse them. A qualitative analysis indicated that this was due to the fact that the encrypted 
information was quantum, rather than the fact that the private key was quantum. It was shown that an attacker's 
Shannon information about a classical key could be bounded, although it was unclear the extent to which secure 
recycling was possible, or whether correlations in different messages could be learned even though the key might 
remain secret. 

key-recycling makes use of one of the fundamental properties of quantum information - it cannot be copied or 
cloned • What this means is that the encryption is such that Eve cannot make copies of several messages in order 
to compare them and deduce the values of the private key. Eve could of course steal or tamper with the quantum 
message, but this will result in a disturbance which can be detected using an error correcting code. This is in stark 
contrast to the classical case where Alice and Bob have no reliable way of knowing whether someone has successfully 
eavesdropped. For these reasons, for an authenticated quantum channel using 2m + 2s bits, (where s is a security 
parameter), 2m + s of the bits can be securely recycled when the QAS is accepted. When the QAS is rejected, just 
under m + s bits can be securely recycled. For the PQC one has a similar rate of recycling. In order to prove such 
recycling, one needs to show that (i) the probability that Eve gains information about the private key can be made 
arbitrarily small when the protocol succeeds, and (ii) that Eve cannot exploit correlations in recycled keys in order 
to gain information about correlations between states sent in successive uses of the channel. 

The fact that one can recycle the private key may seem surprising at first, however, a hint that recycling is possible 
is given by teleportation. Instead of using a private quantum channel, Alice could instead teleport her state to 
Bob. If the classical channel used in teleportation is authenticated, then teleportation also provides authentication of 
the quantum state. Both the PQC and teleportation require similar communication resources - both require m uses 
of a quantum channel to transmit quantum states (either half-singlets in the case of teleportation or the quantum 
states themselves in the case of the PQC ). However, teleportation completely avoids using any private key at all. 
Teleportation also has the added advantage that there is less danger that the message will be lost in transmission 
- the quantum state passes directly to Bob, and there is no way to tamper or destroy it. One can therefore ask, 
what it is that the private key buys us - why is a private key is needed at all? In it was noted that the PQC 
has the advantage that it is non-interactive, i.e. two rounds of classical communication are not needed. The private 
key therefore buys us a decrease in classical communication. This seems like a rather expensive trade-off, given that 
classical communication is usually considered to be a cheap resource, while a private key is usually considered valuable 
(although physically, these resources are incomparable in that neither can be converted into the other). 

One might therefore ask whether there are many situations where it is advantageous to use the PQC over teleporta- 
tion. We will therefore, in Section lll Al give examples where the PQC uses as much or less resources than teleportation. 
These include secure secret sharing, where we find that the related teleportation protocol also requires a private key. 
the PQC therefore consumes less resources than teleportation (i.e. uses (i.e. no classical communication). Further- 
more, we prove the result that in the case of secure secret sharing using teleportation, the classical message which 
needs to be encrypted uses a private key which can also be recycled. 

We will then discuss other cases where the PQC is useful, namely for protecting quantum resources. For example, 
one can use quantum data encryption to protect entanglement. We will also analyze protecting the memory of a 
quantum computer from being stolen and used. We find that often, the attacker will almost always have limited 
abilities which can be exploited to use a one-time pad which is smaller than the 2m bit bound of [3 and Q. This 
ability to beat the 2m bound in specific cases is in addition to our ability to reuse the pad^2- For protecting n bits 
of entanglement, we will see that an n bit reusable pad is sufficient, while for protecting the memory of a q uantum 
computer, it might be possible to use a reusable pad of a size given by the error-correction threshold 

dill- 

Although some of the examples we give may be of a practical nature, our primary motivation for studying the PQC 
is because it is interesting and raises many questions considering the nature of encryption and of quantum information. 
In particular, it allows us to gain additional insight into teleportation by decoupling the sending of qubits from their 
encryption. We will also see that even with key-recycling, the PQC obeys a general rule which we prove, regarding 
the maximum increase of a private key SK as a function of sent qubits 5Q and sent private messages SM. Namely 

SK <SQ- SM . (1) 

We also discuss the thermodynamical nature of such a law. 

We will discuss key- recycling in Section HJ and prove that it is secure. Next, in Section [D] we discuss applications of 
the PQC, including encrypted secret sharing and the protection of entanglement and other resources. We conclude 
in Section ITTll with a brief discussion. 
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I. PRIVATE KEY RECYCLING 

Let us imagine that Alice wants to send to Bob, a state p composed of m qubits, and we consider the possibility that 
the potential adversary Eve may have some prior knowledge of the states that will be sent, or may know from what 
distribution they arise. To create a PQC, Alice "q-encrypts" the state using her 2m bit private key using the method 
°f 0-0 • Essentially, to each qubit, Alice conditionally applies a bit flip in the z-direction, and then conditionally 
applies one in the x-direction, using two bits of her private key as the control bits. The private key is a classical bit 
string randomly chosen from the uniform distribution IC. The encrypted state p a is now maximally mixed regardless 
of what the initial state was, and can be sent to Bob. Such a procedure gives the private quantum channel (PQC). 

Definition 1 A secure Private Quantum Channel (PQC) with error e is a set of classical keys K and computable 
super- operators A k and B k for each key k such that: 

• For any ensemble £ = {pi,Pi}, A k acts on all m-qubit states of £ and outputs an ensemble £' = {pi,ptk} 

• For all pi and keys k G IC: Bk(Ak(pi)) = pi 

• For all ensembles £ and measurements M. acting on £' , H(v : i) < e , where H(v : i) is the mutual information 
between measurement outcomes v and the members of the ensemble i. 

In other words, a PQC is an encryption/decryption scheme, such that for all ensembles, the probability that an 
eavesdropper learns more than e about which state is being sent is small. This definition is somewhat different to 
that of 2, 31 in that we define the PQC with respect to how much information can be gained by an eavesdropper (as 
opposed to just requiring that PQC produce the maximally mixed state p ). Note that the definition, though based 
on Shannon information, does not refer to Eve's knowledge of the states. Indeed, in the PQC paradigm, one assumes 
that Eve may know the states from the very beginning. Note also that such a scheme (unlike teleportation) is only 
one-way i.e. Alice just sends the encrypted state to Bob, and no classical communication need be used. 

We will discuss key-recycling in such a scenario. However, before proceeding to this discussion, we will first consider 
the case of key-recycling in quantum authentication protocols, because there are less subtleties involved. 

A. Key-recycling in quantum authentication protocols 

It usually makes little sense to encrypt quantum information without authenticating it in some way, or protecting 
the state with some form of error correction. This is because unlike a classical message, any eavesdropping on the 
channel may damage the state. Since the states may be unknown to Alice, the state can not be resent. A Quantum 
Authentication Scheme (QAS) is some encoding that Alice performs using a private key shared with Bob, which 
enables Bob to tell whether the state has arrived unaltered. Bob will either accept or reject the state, depending on 
whether he believes he received the correct state. Again, like the PQC, the scheme is one-way. 

Definition 2 [A] A one-way quantum authentication scheme ( QAS) is a set of classical keys IC and computable 
super- operators A k and B k for each key k such that: 

• Ak takes an m-qubit state p and outputs a system pk of m + s qubits. 

• Bk takes as input the (possibly altered) state p' k and outputs an m-qubit state p' , which includes a single qubit 
which indicates acceptance or rejection (denoted by |acc), |rej)J. 

A two-way QAS allows for communication between Alice and Bob during the protocol. The scheme is secure if the 
probability that the protocol is accepted, and that the state is not \ip) is less than e. I.e. 

Definition 3 y|/ A quantum authentications scheme is secure with error e if for all states it satisfies: 
Completeness: For all keys k e IC: B k (A k (\ip)(ip\)) = \ip){ip\ <8> |acc)(acc| 

Soundness: Tr(Pp') > 1 — e where P — \ijj)(ip\ ® |acc)(acc| + I m <g> |rej)(rej| and p' is again the output state. 

Here, security is defined for pure states, and can be extended to mixed states by the linearity of quantum mechanics. 

We will consider a pessimistic scenario from the point of view of key-recycling. Namely, we imagine that Eve may 
know exactly what state is being sent. However, as in Q we will assume that Eve has not already managed to acquire 
part of the state ^5|. We will then see that Eve cannot learn too much about the private key because she cannot 
access all the quantum information. 
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We will show that almost the entire key can be recycled when the protocol is accepted. When the authentication 
protocol is rejected, we find that half the key can be recycled. We will show that Alice and Bob can place a sufficient 
bound on Eve's information (regardless of the initial state and Eve's prior knowledge), that they can perform a process 
known as privacy amplification ljj to recycle their key. Essentially, they are able to publicly communicate, to distill 
from their 2n bit key, a slightly smaller key of which Eve has an exponentially small probability of knowing anything 
about. We then show that this recycled key can then be used in another round of the QAS. 

To get a true bound we will discuss a general authentication protocol based on stabilizer purity testing codes (error 
correcting codes) used in Ref. 0. The protocol of this scheme (SQAS) is as follows 



Protocol 1 ( Stabilizer based Quantum Authentication Scheme (SQAS) ) 

1: Alice and Bob share a secret key x of length 2m to be used for q- encryption. For authentication, they additionally 
agree on some stabilizer purity testing code {Q z } and two secret keys z and y of combined length 2s. 

2: Alice uses x to encrypt an m qubit state p as p . 

3: Alice encodes p a according to Q z for the code Q z and adds syndrome y to produce a . This requires s additional 
qubits. She then sends the total state of n — m + s qubits to Bob. 

4: Bob receives the n qubits. Denote the received state by a' . Bob measures the syndrome y of the code Q z on his 
qubits. Bob compares y to y , and aborts if any error is detected. Bob decodes his n-qubit word according to Q z , 
obtaining p' a . Bob q-decrypts p' a using x and obtains p' . 



Essentially, Alice not only q-encrypts the state p using 2m bits of classical key, but she also encodes the state using 
an error-correction protocol based on a set of stabilizer codes, and determined by some additional private key. An 
additional s qubits are used during transmission. The length s is determined by the degree of channel noise or extent 
of anticipated eavesdropping. Such a protocol can protect against an arbitrarily large amount of eavesdropping. An 
example of such a scheme was shown in [4j using a particular purity testing code {Q z } which gave a soundness error 
2n/s(2 s + 1) using an additional key of length s + log 2 (2 s + 1). If the authentication scheme passes, we will see that 
they can recycle the key because the probability that Eve has any information about the state or the key can be made 
arbitrarily small, and Eve is product with the sent states. 

The proof of security of Protocol ^ given in £j is analogous to the Shor-Preskill security proof of BB84 One 
essentially shows that such a scheme can be converted into a teleportation protocol without loss of security. 

We now turn to proving security of key-recycling. By security, we mean that if one has two secure QAS with two 
keys k and I, to authenticate two states, then the scheme is still secure if one can replace the key I with a key recycled 
from k. Denoting the length of a key by ||, we have 

Definition 4 A Secure Key Recycling scheme of error e and efficiency k'/k is a map A : K, — ► K' such that if £k o-nd 
£[ are secure QAS on Hilbert spaces Ti and TC then when the QAS are accepted £' k ,£k is a secure QAS on Ti ® W 
with error e when \l\ = \k'\ with kl — A(fc). 

The error e depends not only on the key-recycling scheme but also on the security of the QAS. 

The proof in Q of security of the QAS assumed that Alice and Bob are authenticating pure states (or parts of 
pure states). I.e. it is assumed that the adversary does not already hold part of the state being sent. After the arXiv 
version of this paper appeared, this condition was removed in the more general and detailed work of 18]. We will 
also make this assumption, and under it, now prove the following 

Theorem 1 For the QAS of Protocol^ there exists a secure key recycling scheme with efficiency rate 2m+2s • 

To prove Theorem^we first need the following lemma saying that sending half of a singlet does not need encryption 
by x. 

Lemma 1 Consider the maximally entangled state composed of two subsystems \ip+) = I 1 1 2 on 'Hm®'ri m , with 
dimension 2 m x 2 m and p being the state obtained from tracing out one of the subsystems. Then a secure SQAS using 
Protocol^ for p with a key of length 2m + 2s is also secure using a key of length 2s. 

In other words, for half of a maximally entangled state, the key x is not needed, only the key y and z. 
Proof: Alice uses ProtocolHon subsystem 2 except that neither step 2, nor the key x is used. We then note that 
because 



I®U\iP + ) = U*®I\ip + ) 



(2) 
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Alice can replace step 2 by q-encrypting subsystem 1. Then, due to Eq. [5] this protocol is completely equivalent to 
Protocol and is a secure QAS. Then, since Alice's actions on subsystem 1 commute with Eve's and Bob's actions 
on subsystem 2, it cannot matter whether Alice actually performs the q-encryption of subsystem 1. | 
Now, we prove Theorem ^ using a technique analogous to that of Shor-Preskill. 

Proof: Let us consider a variation of Protocol^ acting on a pure state ip by assumption (by the linearity of quantum 
mechanics, our proof will hold if only part of the state is being sent. I.e. it holds for any p as long as the purification 
is not with Eve). The modified QAS, Protocol [3 differs in step 2, and the final step from Protocol ^ 

Protocol 2 ( modified QAS ) 

1: Alice prepares the state l lrn ^2 X \x) where the \x) are 2 2m orthogonal states. For authentication, Alice and Bob 

additionally agree on some stabilizer purity testing code {Q z } and two secret keys z and y of combined length 2s. 
2: Alice q-encrypts tp conditionally on \x) creating the state -j^sm Ylx l 2 ')!^) 

3: Let us call the subsystem which is the mixture of ip x 's p. Alice encodes p according to Q z for the code Q z with 
syndrome y to produce a. This requires s additional qubits. She then sends the total state of n — m + s qubits to 
Bob. 

4: Bob receives the n qubtts. Denote the received state by a' . Bob measures the syndrome y' of the code Q z on his 
qubits. Bob compares y to y , and aborts if any error is detected. Bob decodes his n-qubit word according to Q z , 
obtaining p' . 

5: If Bob accepts, Alice measures \x) to obtain a random string x 



First we note that because tp has essentially been q-encrypted by the action's of Alice, p is the maximally mixed 
state p . Therefore, the state ^2 X \x)\ip x ) is a maximally entangled state ip+ of 2m qubits (Actually up to local 
unitaries, on Alice's side it is half a singlet tensor the initial state). Therefore, by Lemma if Bob accepts, then 
Alice and Bob share a state p' AB that has an overlap with yb + equal to 1 — e'. One can now use standard reasoning 
originating in 19]: since Alice and Bob share an (almost) pure state, they are decoupled from Eve. 

Alice can then measure x without Eve learning what x is. From the point of view of Eve, Protocol's completely 
equivalent to Protocol^ and therefore, if Bob accepts the authentication, the probability that Eve has obtained more 
than e information about x is small. 

It should be pointed out that Protocol [21 is not equivalent to from the point of view of Bob, since he does not 
have the key x. However, this is not relevant, since he decides whether to accept the authentication before decoding 
using x. Therefore neither his actions nor Eve's depend on the modifications that Alice makes. One can in fact show 
that the preceding protocol is in fact, equivalent to teleportation. 

Let us now prove that Eve is product with x and the sent state. This will ensure not only reusability of the key in 
another QAS, but in any other cryptographic task according to [2(| and [2l]]. This essentially follows from the fact 
that if the authentication is accepted, the protocol is equivalent to teleportation. Let us consider the total state of the 
system, before step 5 of Protocol |21 Using the fact that all ancillas and all actions by the parties can be represented 
as unitaries acting on pure states, we can write the total state of the system in the form 

* = ^T,\ x ) U B U EUA(\y> x )\0)E\0)A'\y,z) A/ ,\y,z) B// )\y,z) R 

x,y,z 

= Y,VPiWi)\<t>i) (3) 

i 

Here, the key used in the authentication is encoded in the states \y, z)ji"\y, z)b" which is labeled by the particular 
2s bit key {y, z} that is used in the QAS. Since this is a classical key, we purify it on an imaginary reference system 
\yz)n to which none of the parties have access. The first unitary Ua is the further encoding done by Alice, and it acts 
on the states ip x and the s qubit ancilla |0).a' conditional on the authentication key \y, z)a"- The second Ue are the 
actions of the eavesdropper acting on the m + s qubits sent across the channel, and Ub, the decoding of Bob, acting 
on the ancilla and sent state ip x (conditioned on \y, z)b")- 

In the second line we have rewritten '5 in terms of the eigenbasis of maximally entangled states (one of which is 
the state ifi + = ip = \x)\ip x ))i correlated with states on the ancillas <f>i (which need not be orthogonal). Now, if 
the QAS is accepted, then we have according to Definition [3] of a secure QAS 

Tr{Tr A 'A»B»RE(\^)(^\)\i>+)(^+\) > 1 - e ( 4 ) 

which implies that with probability po > 1 — e, the state of the system is \ip+) <8> \4>o) which implies that with arbitrary 
high probability, Eve is product with the key x and the encoded state ip x (even more strongly, all ancillas, as well as 
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the key {y, z} are product with x and the sent state ip). From the composability theorem |20|. this implies that the 
key x can be reused in the second QAS (using the same methodology of [21j, since one can also regard this protocol 
in terms of security of key) . 

Note that we not only had to proves Eve's lack of knowledge about x, but also that she was decoupled from the 
sent states. This then gives that the recycled key k' can be used in a secure QAS. The danger, is that k' might not 
be reusable, because it is correlated to the sent states. For example, in Sec. II ( 'I we will see that with respect to the 
PQC, one must be concerned with the fact that Eve could learn about correlations between different sent states, even 
though she learns nothing about the key. However, reusability of k' in the QAS follows from the definition of the 
QAS. Essentially, since the QAS is not defined in terms of Eve's knowledge, but in terms of Bob verifying he got the 
correct state, one needn't worry whether Eve is correlated with the sent states - we can assume she already knows 
them. 

Let us now turn to the key {y, z} which was used in the purity testing code. It is of length 2s, and we now show 
that we can perform privacy amplification to obtain a key of length s which can also be re-used. In the first arXiv 
version of this paper, we showed that the probability that Eve obtains more than an exponentially small amount of 
information about the key is exponentially small, using results of [22L l24j. And further, that this part of the key 
was product with the sent states. Since then, the results of pl| appeared, and we can use their stronger bounds to 
show that Eve is in fact, product from s of the bits which can be recycled from the 2s key used in the authentication 
step. Thus we can formally prove that this part of the key can also be re-used using the stronger security definition 
of composability. 

Alice and Bob will need to perform privacy amplification [Tril ] on the keyly, z} to produce a smaller key of length 
s, and in order to prove the security of this privacy amplification, we use [25j: 

Lemma 2 Given a set of two-universal Hash functions \2&1 G from J, a random classical distribution with 
density matrix pj, to a distribution T with range {0,1}* and density matrix pt{G), joint density matrices 
Pje,Pte{G), and marginal distribution pe — trjpjE — trrPTE(G) then EG(tr\(pTE(G) — pr{G) ® pe\) < 
25 ( lo s ^max(p.iE)+}og{rank(p E ))+t) _|_ 2 e w here is the expectation value over G, and \ m ax is the largest eigenvalue. 

Intuitively speaking, the above lemma places a bound on how close the privacy amplified distribution is to being 
product with an eavesdropper. 

In the case under consideration, if the protocol is accepted, then as shown above, with probability p > 1 — e the 
total state of the system is <8> |</>o) with with Alice and Bob, and |</>o) on A' A"B"R and E. With high 
probability, Eve is completely product the m qubit singlet, and the total state is 

\^+)AB ® \4>o) A'A"B"ER ■ (5) 

Upon acceptance of the protocol, we can thus simulate the situation by giving the entire A' to Eve, since this can 
only further degrade the security. Then, with probability p > 1 — e, Eve's state pe has maximal rank s, since she is 
effectively only acting on the s qubit ancilla. The largest eigenvalue X max of the density matrix on A' A" B"E is no 
greater than l/2 2s (since the probability of any y, z is this large. Thus by Lemma|2 EQ(tr\(pxE — Pt <8> Pe\) will be 
small if we choose the recycled key of length t — s — 2. Here, Pt(G) is the density matrix of the privacy amplified key 
{y, z}. This is precisely the condition needed for composability of a key found in |2l| . and ensures that just under 
half of the 2s bit key used in the authentication process can be recycled. The total efficiency of the recycling is then 
a rate of (2m + s)/ (2m + 2s) . | 

Here some remarks concerning our use of composability are in order. Our primary goal is to prove that the key 
can be recycled. In the case of x we had two problems we fought with: not only 1) Eve should have small knowledge 
about the recycled key, but also 2) Eve should not be correlated with the total system: message plus recycled key. 
This is precisely a place, where recycling of the classical one-time pad fails: knowing that the key was used once more, 
Eve will get to know information about correlations between subsequent messages. 

In our case we assume from the very beginning that Eve knows the message. Then, correlations of Eve with system 
"recycled key plus message" would be dangerous because Eve would then get to know the key, and in some further 
round, she would break authentication (i.e. tamper with the sent state, without causing Bob's rejection). Thus, 
both in case of key x and z,y we showed that the recycled keys are not correlated with the states subjected to 
authentication. 

Let us now consider the case that the QAS is rejected. Typically, Bob will reject the authentication if the noise 
level or eavesdropping is higher than anticipated. I.e., if Alice uses an error correction code which is not large enough. 
In such a case, we will show 

Theorem 2 For the QAS of Protocol^ if the protocol is rejected, there exists a recycling scheme with efficiency rate 

m+s 
2m+2s 
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In the initial arXiv version of this paper, our recycling scheme in the case of rejecting the QAS yielded s bits of 
key. We obtain a better rate of recycling by simply giving Eve all the m + s qubits. Then, the maximal rank of Eve's 
state is thus m + s, and the maximum eigenvalue of the total state (authentication key plus Eve's state) is bounded 
by i/2 2m+2s . Thus by use of Lemma|5|we can re-use the key if we hash the total key to a size just under m+ s. | 

An important aspect of the key-recycling scheme is that it doesn't particularly take away from the advantage of 
the QAS over teleportation. The QAS has the advantage that it is a non-interactive (only one-way communication 
is needed, but at the price of a private key). Key-recycling will require a small amount of back-communication (Bob 
must tell Eve whether he accepts or rejects the state). However, the back-communication and key-recycling can be 
done at the convenience of the two parties. I.e. if Alice needs to send states so that Bob can use them right away, 
then this can be done, and later, during a break in the transmission, they can engage in key-recycling. Therefore, a 
QAS plus key-recycling still has an advantage over teleportation in terms of interaction. 

B. The slippery slope towards teleportation 

Having determined that the key can be recycled in QAS, one must then wonder if it is needed at all. Indeed, this 
is the case. At the end of Protocol [21 Alice after measuring what x is, can just tell Bob the result publicly. This 
is no less secure than Protocol |21 since the stabilizer code ensures that Eve didn't touch the state, and therefore, by 
the time she learns what x is, it is too late. In fact, the keys z and y in Protocol can also be replaced by public 
communication from Alice to Bob (as long as the classical public communication channel is authenticated). This 
results in Protocol 



Protocol 3 ( modified QAS ) 

1: Alice chooses random strings x, y and z. Alice and Bob additionally agree on some set of stabilizer purity testing 
codes {Q z } 

2: Alice q-encrypts %j) conditionally on x creating the state t/jx 

3: Let us call the subsystem which is the mixture of ip x 's p. Alice encodes p according to Q z for the code Q z with 
syndrome y to produce a. This requires s additional qubits. She then sends the total state of n — m + s qubits to 
Bob. 

4: Bob receives the n qubits. Denote the received state by a' . He indicates receipt to Alice. 

5: Alice tells Bob z, and Bob measures the syndrome of Q z on a' obtaining the result y' . Alice and Bob compare y to 
y' , and abort if any error is detected. Bob decodes his n-qubit word according to Q z , obtaining p' . 

6: If the protocol is accepted, Alice tells Bob x and Bob decrypts p to obtain tp' 

That this protocol is secure can be seen by noting that it is essentially teleportation (as was Protocol |2l . In 
teleportation, Alice sends n half-singlets to Bob, and then they measure the syndrome y of the random code Q z . If 
they both get the same y, they can presume that the singlets are pure, and they begin teleportation. The preceding 
protocol differs from teleportation, only in that it is as if Alice has made the Bell measurement to start teleportation, 
and measured the syndrome of Q z , before sending the state to Bob. Since such measurements don't change the density 
matrix, they clearly can't reduce security. 

This procedure, has the advantage over the QAS in that less key is needed - not a surprise given that much of 
it can be reused in the QAS. Of course, it is interactive, while for the QAS with recycling, the interaction can be 
performed at any time, well after Bob has used his received state. This in some sense highlights the role of the secret 
key x used in the QAS. It's purpose is not as much for encryption (since Alice could use a random string instead and 
later tell Bob), but rather, it serves a role of communication. In other words, it allows one to have a non-interactive 
protocol. In fact, there is still interaction - the key was distributed at some point in the past, and might be recycled 
at some point in the future - but this interaction can occur at more convenient times. The price (the secret key), is 
of course rather high. 

C. Key-recycling for the Private Quantum Channel 

Having discussed key-recycling for the QAS, we now turn to key-recycling for the PQC. We consider here a PQC 
such as that of 0, 0] - namely, for each qubit of message, one uses 2 bits of private key, with Alice performing one of 
four operations on each qubit conditional on the key. We will now explain why to get key-recycling for the PQC, one 
must actually use authentication or purity testing. One therefore must actually do key-recycling of the QAS. 
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At first, it might seem that for the PQC one can easily recycle half the key, based simply on the generalized Holevo 
bound given in the Appendix. Eve will be ignorant of half the key, no matter what states are being sent and how 
much she knows about the states that are being sent. 

There is however, a problem with this. Eve may not be interested in learning the key or the identity of a particular 
state, but may instead be interested in learning about correlations between the various quantum states being sent 
between Alice and Bob. Let us imagine that Eve does not try to learn anything about the state p encrypted with k 
but instead, just steals it. Then, when Alice and Bob send a new state p' encrypted with k' she steals that as well. 
Now she may not know much about these two states, but she will learn something by having both of them. The 
reason is that k', although unknown to Eve, is in fact correlated with k. This means that Eve will be able to learn 
something about the correlations between p and p' , even though she has no knowledge about k and k' . 

The amount of information that Eve can learn about the key, depends not only on how much she knows a priori 
about the states being sent, but also on which states being sent. For example, for mixed states, from the Holevo 
bound one has that Eve will learn less than m bits of information about the key. Even for pure states, Eve will in 
general learn much less. Consider for example the state 

|tt/4) = cos(tt/8)|0) +sin(vr/8)|l) . (6) 

It is easy to verify that this state gets encrypted into one of four non-orthogonal states |0), |1), |0 + 1), or |0 — 1), 
conditional on the private key. These are the same states used in BB84[9|. 

Now, it may be that Eve did not steal the state, or was unsuccessful in her eavesdropping. It therefore seems a 
pity for Alice and Bob to throw out k if this is indeed the case. Classically, Alice and Bob have no way to determine 
whether eavesdropping was successful, but this is not the case for the encryption of quantum information. Alice and 
Bob can indeed discover whether Eve tampered with their state using a QAS or a purity-testing protocol to ensure 
that they still possess the original state p. Then, because of the no-cloning theorem[lCj. they can be sure that Eve 
did not steal or tamper with p. 

While an authentication scheme such as that of Protocoinwill be enough to enable key-recycling, one can also have 
Alice publicly announce the authentication strings y and z, exactly as was done for Protocol^ However, since these 
have to be done over an authenticated classical channel, it is doubtful that this would be less resource-intensive. 

In summary, if one wishes to perform key-recycling of a PQC, one needs to augment the PQC with some authen- 
tication. The amount of key-recycling is then given by Theorem ^ Since any authentication scheme is also a PQC 
0, the theorem also guarantees security of the PQC. As was noted in our proof of Theorem^] Eve will be virtually 
product with the encrypted states ip x . It is for this reason that Eve is not able to gain information about correlations 
between the various states being sent. 



D. The basic law of privacy 



It might make one uncomfortable that the length K of the private key need not decrease by 1 for each qubit of 
encrypted message sent. We now that classically, one cannot increase privacy through communication. However, we 
know that due to quantum key distribution, the size of a private key can increase for each qubit sent. Quantum 
communication therefore allows one to increase the size of a private key by 1 per qubit sent. If the number of sent 
qubits is 5Q, and the size of an encrypted message which gets sent (whether quantum or classical) is SM, then we 
note the following general law. For any communication between two parties 

SK < SQ - SM (7) 

where SK is the change in length of the private key. Such a law, while probably known on some intuitive level, has 
never been stated or proven to the best of our knowledge. We note that our recycling protocol respects such a law, 
as does teleportation. 

Proof: Assume for contradiction that the basic law is violated. Then, in the case where the additional message 
SM is classical, we imagine that the message sent is used to create additional key of length SM (since the private 
communication can always be communication of the private key). Thus a violation of the basic law would imply 
SK > 5Q. That the latter inequality can't be true follows from |27|. where the theory of privacy was recast in terms 
of entanglement theory, and thus it was shown that the relative entropy of entanglement, 

E t (pab)= min Tr(pAB log pab ~ Pab log o~ab) (8) 

(where the minimum is taken over separable states) is an upper bound on the key rate. Since E r is less than E c (the 
entanglement cost) of a state (which is by definition Q), it follows that SK < SQ. This gives the desired contradiction. 
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If the additional message SM is quantum, then the quantum channel must work for all states (since by definition 
of a quantum message the sent states are unknown and decoupled from the environment). We could thus send half 
of a singlet for each qubit of message, and then use it to create one bit of key. We would then again have SK > SQ. | 

It is actually quite surprising that |27| is needed for what appears to be such a basic and simple result. One 
imagines that SK < SQ would follow from the Holevo bound, but because a key is a strictly weaker resource than 
communication, and can be distilled using many rounds of public communication, standard techniques appear not to 
work. 

The laws of privacy bear a resemblance to thermodynamics - not surprising given their information-theoretic 
nature. Alice and Bob each possess a random string of maximal entropy. K therefore, represents a decrease in the 
total entropy of Alice and Bob's string, due to correlations - it is a negentropy. In the absence of eavesdropping, both 
teleportation, and our recycling protocol have SK = 0, and are therefore optimal. They are, in a sense, isentropic 
processes. On the other hand, eavesdropping disturbs the system, and results in an increase of entropy between Alice 
and Bob. The size of the private key (or negentropy), goes down. This is like the second law of thermodynamics. The 
leakage of information to Eve is physically very closely related to the processes that produce an increase of entropy 
in thermodynamics: Indeed, the process that conserves energy and increases entropy is exactly eavesdropping I.e. it 
is pure decoherence (if we will not consider just coarse graining). In the case of no eavesdropping, then the bound of 
Equation J7J) gets saturated, and you have a law which looks very similar to the first law of thermodynamics. In that 
sense, one should think of the sent messages as work which is being performed. 

II. APPLICATIONS 

As noted in the Introduction, if two parties are interested in sending an unknown state between them, they are 
likely to chose teleportation over the PQC. To teleport an unknown state, Alice sends a number of halves of singlets to 
Bob, and then they use distillation to ensure that they are indeed sharing pure singlets (since the sent entanglement 
may get corrupted due to noise, or the actions of an eavesdropper). After distillation, Alice makes a measurement 
on her half of the singlets, and sends the results to Bob, who can then transform his half of the singlets into the 
state which is to be transmitted. Since the outcomes of Alice's measurements are completely random, Eve gets no 
information about the state which is being sent. Teleportation therefore, automatically ensures encryption. If the 
classical channel is authenticated, teleportation also ensures authentication of the quantum information. Additionally, 
the unknown state is never held by Eve, and so, it cannot get destroyed or corrupted. 

Both teleportation and the PQC therefore need one usage of the quantum channel for every qubit which is to 
be sent and encrypted. The amount of classical communication needed for teleportation n qubits is one round of 
O(logn) classical bits (c-bits) from Bob to Alice, and 2n c-bits from Alice to Bob. The first round is used in the 
distillation process (Bob needs to tell Alice which singlets he tested for purity, and how noisy the singlets are), and 
the second round is needed for Alice to tell Bob the result of her measurement. The PQC does not need these two 
rounds of classical communication, but it does need the private key. It therefore seems that this saving in classical 
communication for the PQC comes at an expensive price (the private key). 

One might argue that the private key can be recycled, and therefore, it doesn't represent much of a cost. However, 
some of the private key will be lost in the case of heavy eavesdropping or noise. Furthermore, recycling the key 
also requires interactive communication. Bob must inform Alice how much noise is in the check-bits and which 
privacy amplification function they will use. This communication can occur at a more convenient time (after Bob has 
decrypted the states), but it is still needed. 

We therefore inquire into situations where one might prefer the PQC over teleportation. One situation where the 
two are equivalent, is if one wishes to store the quantum information in one's own lab, but does not trust other people 
in the lab. One could then q-encrypt the states, and keep the key somewhere safe. One could also use teleportation, 
and keep the results of the measurement locked away, but preparing singlets to teleport a state to oneself seems 
rather silly. Here, we show other applications of the PQC. In Subsection III Al we consider a situation which we 
call secure secret sharing which requires either a modified version of the PQC or of teleportation. In this case, both 
protocols require the same amount of resources - namely, a private key and 2 cbits of communication. We also find the 
interesting result that in this case, the private key, which is used to encrypt classical information, can also be recycled. 
We will present an asymmetric version of secure secret sharing (one party is more trusted) in which the teleportation 
protocol is more resource intensive. We also explore two other examples where one wouldn't use teleportation, namely, 
the protection of quantum resources such as entanglement or the memory of a quantum computer. For protecting 
entanglement, the private key is half the size of the general case. These examples are discussed in Subsection III Bl It 
is the the protection of quantum information where the PQC may find its most useful application. 
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A. Encrypted quantum secret sharing 

Let us first consider the following scenario which we will call encrypted quantum secret sharing. We imagine a 
scenario similar to original secret sharing 28J: Alice wants to send a quantum state to Bob and Claire, but she does 
not want either one to be able to use the state separately. Alice desires that they cooperate in order to decrypt the 
state. However, we also imagine that both Bob and Claire are extremely adversarial and may try to eavesdrop on 
each other's communication channels in order to learn the state. Or perhaps, there is a concern that another party 
may eavesdrop on the channel. 

Consider the following modification of the QAS (e.g. Protocol Alice shares a classical private key X with 
Bob (to be used for q-encrypting), but rather than q-encrypting the state using this key, she instead q-encrypts the 
quantum state using another random string J and then applies the authentication protocol using key S (shared with 
Claire). She then sends the encrypted quantum state to Claire. Since Bob doesn't know J, he will gain nothing by 
eavesdropping on the quantum channel between Alice and Claire. Once Claire receives the quantum state, she checks 
to see that the state has arrived intact using S. If the authentication test fails, they abort. If the test succeeds, 
Alice classically encrypts the random string J using X and sends the encrypted string to Bob. This prevents Claire 
from learning the key used to encrypt the state she has, while Bob can decrypt J using X. Claire now possesses the 
encrypted quantum state, while Bob possess the key, and they will not be able to decrypt it unless they cooperate. 
The total protocol has consumed 2n bits of shared private key and 2m bits of classical communication between Alice 
and Bob, and n uses of the quantum channel from Alice to Claire. The state can only be decrypted if Bob and Claire 
get together and cooperate. 

The protocol involving teleportation requires the same amount of resources. Alice sends half-singlets to Claire, 
and they use a purification testing protocol over an authenticated classical channel to ensure that they indeed hold 
singlets. Alice then makes the joint measurement on her half-singlets and the state to be shared. Alice then encrypts 
the results of the measurements using the key shared between herself and Bob, and sends it to him. 

Key recycling can be done in both these cases, although it is a bit more problematic if one is concerned not only 
about a party learning the key, but also, correlations between different states. The transmitted states will need 
two layers of authentication. Essentially Claire needs to be sure that either the singlets or the transmitted state is 
authentic, and then Bob would need to test for authenticity when they decrypt. This would need to be done Claire's 
lab and so the situation may be a bit awkward for this to occur with Claire hovering over his shoulder (however, one 
may assume that they are polite enough to each other in person to allow this to happen) . Alternatively, Claire could 
test for authenticity in the presence of Bob, assuming that Bob is allowed to test Claire's apparatus. Key recycling 
makes more sense in the case where one is concerned about eavesdropping from some other party, in which case only 
one layer of authentication is needed, since Alice can trust Claire's acceptance of the authentication. 

This recycling in the case of encrypted quantum secret sharing is perhaps more surprising than recyclability in the 
original PQC protocol, since in this case, the information being encrypted is classical. In the case of teleportation, it is 
the result of Alice's measurements which, although random, could be used by Claire to learn what state she has. The 
proof of this recyclability is almost identical to Theorem^ The only difference is that here, one does not need to show 
that Eve must be product with the message (J in the case of QAS-type protocol, and the result of Bell measurements 
in the case of the teleportation protocol). Indeed, she will not be, as both strings are classical. However, we do not 
need this to be the case, because there are no correlations from one round to another - the messages are completely 
random strings. 

One can envision situations where the PQC is less resource intensive than teleportation. Consider the following: 
Alice wants to send a state to Bob, but because quantum channels and labs are expensive, Bob has neither of these. 
The only option then, is for Alice to send the state to Claire, a technician in a large company which owns all the 
quantum channels, and which also has storage equipment for keeping quantum states. Claire is however, not trusted. 

Alice can however, encrypt the quantum state using the key shared between her and Bob, and send the state to 
Claire. Bob can then go over to Claire's lab any time he chooses, and decrypt the state (we once again imagine that 
he is able to test the equipment first). The teleportation protocol however, uses more resources. The half-singlets 
are sent to Claire, and the results of the measurements sent to Bob. The measurement results that are sent to Bob 
have to be encrypted, to ensure that Claire doesn't eavesdrop on Bob's classical channel. Therefore, the teleportation 
protocol also needs a private key. It is therefore more expensive, because it needs two way communication, while the 
PQC does not. 

B. Protecting entanglement 

We now turn to the issue of using PQC to protect various resources, and we demonstrate a scenario where only n 
bits of private key are necessary and sufficient rather than 2n. Let us imagine the following: there is a teleportation 
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devicejllj set-up between Alice (who is on Earth) and Claire (a robot) who is on the planet Venus. The more 
practical reader can instead imagine a device which can be used to perform quantum key distribution between Earth 
and a satellite, and we note that related devices for satellite deployment are already being tested |2£j [2]]]. Now, the 
teleportation device between Alice and Claire is essentially made up of many entangled states shared between Alice 
and Claire which we take to be the singlet 

*l>- = \Q1) ac AC • (9) 

We assume that these singlets have already been authenticated, and so Alice possesses many singlet-halves which look 
locally like maximally mixed states. She may decide that she will not use the device, but instead wants to send her 
states to Bob for his use. They may have two concerns: 1) to ensure that an adversary Eve has no idea what quantum 
states are being sent, or 2) they may not care what Eve knows but want to ensure that Eve will not steal the states 
for her own use (since she may want to use the device to also teleport something to Venus). 

Here, we consider the latter case (which we shall refer to as quantum data protection) , and assume that Eve is also 
located on Earth. One way to ensure that the singlets will never fall into the wrong hands is to have an authentication 
protocol set up between Claire, and the authorized party on Earth. However, this is only useful if one can be sure 
that Claire's singlets will also never fall into the wrong hands. It may be that Eve has a friend on Venus who might 
take control of the teleporter. 

Alice, would therefore want to perform some sort of protection protocol on her half of the singlets, to ensure that 
if Eve steals them, they will be of no use. In this case, we do not need the full encryption scheme of 0,0] which uses 
In bits of private key, but can instead use a scheme using only an n bit private key. We now show that n bits are 
necessary and sufficient to protect entanglement. 

To show sufficiency, consider the following protocol. Alice and Bob share a private key k and Alice divides her 
states into large blocks of size n and performs the bit flip operation (a x ) on each of her qubits conditional on each bit 
of the private key. The total state of each qubit is then 

pabc = |(|oo)<oo| ® IV-XV-I + luX 11 ! ® \i>+){i>+\) (10) 

where ip+ is the Bell-state (OO)^ + |H)ac shared between Alice and Claire, and the states |00) and |11) is the 
classically correlated private key shared between Alice and Bob. An adversary who does not have access to the key, 
receives the state 

PCE = \\^-)^-\ + \\^+)^+\ (11) 

It is immediate to find using e.g. the partial transpose test that this state is completely unentangled, and is of no use 
whatsoever to an adversary wishing to use the singlets. 

To show that n bits of private key are necessary, we note that we would not be able to use less than n bits of 
randomness because any mixture of a singlet with another pure state is unentangled unless p=l/2. More explicitly, 
the encryption amounts to applying some unitaries Ui with probabilities pi to Alice's halves of singlets. The amount of 
used bits is then given by the entropy H ({pi}). To get a bound for the entropy, we note that Alice wants the state to be 
separable, while the separable state satisfies S(qab) > S(qa) H3- In our case qab is the state obtained from singlets 
after applying the random unitaries. We have S(qa) = n, where n is amount of singlets while S(qab) < H({Pi})- If 
the state is to be separable, H({pi}) must be then no smaller than n. 

After protecting the singlet, Alice can send her n qubits to Bob. Bob can then test the received qubits to ensure 
that Eve has not stolen any, by simply testing for purity (for example, by using the stabilizer codes used in Protocol 
In the above scenario, we are not encrypting quantum information but rather protecting it - we assume that Eve 
already knows that Alice is trying to send the half-singlets to Bob. 

We can use key-recycling also in this case. If, for example, we use the additional layer of authentication, and the 
test passes, then Alice and Bob reuse the key. Here, they can reuse the key, even though it is only n bits long to begin 
with. This is because the bound given in the Appendix ensures that Eve can learn nothing about the key. The half 
singlet states are already maximally mixed, and so there is no measurement that Eve can make which would allow 
her to guess the private key. 

Finally, one can also use quantum data protection even when not sending data to another party. One might imagine 
that Alice is concerned that someone in her lab (Eve) might steal the entanglement and use it for some unauthorized 
purpose. Alice could use quantum authentication, which would let her know that the entanglement has been tampered 
with, however by then it is too late, and Eve has possession of the half-singlets. Again, setting up an authentication 
protocol is no good if Eve has a friend on Venus who might also steal the other half of the singlets. Alice can therefore 
use the protocol above using her own private key. This private key can easily be stored somewhere safe, as opposed to 
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the quantum states which presumably must be stored in a prominent place in a lab, as the states need to constantly 
be protected against decoherence. Note that in the case of storage, a teleportation protocol makes little sense. 

There are other example's where one can use the PQC to protection quantum data. For example, one might one to 
protect the memory of a quantum computer, especially if one is running a long factoring algorithm, and one doesn't 
trust other people in the lab. In such a case, one might make do with a key which is only as long as the threshold, 
beyond which error correction is imnossible[13l Il4j. I.e. one introduces errors conditional on a key, such that the 
computation can no longer be performed. These errors can be undone if one has the key, and the computation can 
proceed, but without the key, the computer will not run. Whether an adversary might still be able to get some 
information by performing some measurement on the quantum memory in such a scenario is not clear. 

III. DISCUSSION 

^From a conceptual point of view, the private quantum channel and the authenticated quantum channel are in- 
teresting because it allows us to decouple the sending of a quantum state, and the encryption/authentication of a 
quantum state which are automatically coupled in teleportation. Since teleportation does not require a private key, 
we have inquired into the necessity of the private key used in the QAS. Indeed, we find that in some sense, the private 
key is not needed, as one can keep reusing the same private key, adding only a small amount of additional private key 
each time. The role of the private key was seen to be more significant in terms of communication - it allows the QAS 
to be non-interactive. It would be interesting to better understand the role of the private key. If it can be recycled, 
one wonders the extent to which it is needed at all. 

Encryption of quantum information is different from encryption in the classical case. One can have the exact 
opposite scenario: Instead of Alice knowing the state, and Eve trying to learn it, one will likely be concerned about 
the case of Alice not knowing the state, and Eve knowing something about it. We therefore introduced the notion of 
protecting quantum resources. Namely, the private quantum channel allows us to ensure that certain resources cannot 
be used by an adversary. This is in contrast to the usual role of encryption, which seeks to prevent an adversary 
from knowing a message. It was found that for protecting some resources (such as entanglement), less private key 
was needed. Other applications, such as an encrypted version of quantum secret sharing were also introduced. 

We also introduced a basic law of privacy which governs how the size of the private key changes as a function of 
sent qubits and encrypted messages. We believe it would be interesting to explore this law further, as well as the 
analogy between eavesdropping and thermodynamics. 
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